The difference between the two calls is on the last TGS_REQ; because
the first one is on ldap/olmo.example....@example.com and it's OK
whereas the second one is on HTTP/olmo.example....@example.com that
returns a 401 (I suppose).

Where's the error?

Am I correct that you have a user connecting to HTTP/ebano.example.com
and then HTTP/ebano.example.com wants to talk to HTTP/olmo.example.com
using credentials of the user?
FreeIPA uses constraint delegation of the credentials, with the help of
S4U2Proxy extension. You need to allow HTTP/ebano.example.com to delegate
credentials to HTTP/olmo.example.com.
I have written an article how to do that: